Harden API security and resolve CodeQL alerts

[bnz183]

Summary

• Adds API rate limiting before body parsing, with stricter limits on auth and write endpoints
• Adds scrypt admin password hash support and safer dotenv serialization
• Upgrades Cloudinary signing to SHA-256 and replaces hand-rolled Ghost JWT HMAC with jose
• Replaces regex-based path normalization with deterministic helpers
• Adds explicit least-privilege GitHub Actions workflow permissions

Test plan

• pnpm build
• pnpm test
• pnpm test:e2e

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.